UserRecordAccess not reflecting Share record for contact in test

Question

Per the title I'm seeing weirdness when trying to share a record in a test class.

I'm writing a test where I have two users set up, I create two new contacts and assign the first user as their owner. the profile being used by both users has a base Read access for Contact.

I want to test giving Edit access to the second user, for just one of the contacts. In the test, I create ContactShare records for the contacts and the the second user;

// create shares
List<ContactShare> shares = new List<ContactShare>();
shares.add(New ContactShare(
        UserOrGroupId = users[1].Id,
        ContactId = contacts[0].Id,
        RowCause = 'Manual',
        ContactAccessLevel = 'Read'
));
shares.add(New ContactShare(
        UserOrGroupId = users[1].Id,
        ContactId = contacts[1].Id,
        RowCause = 'Manual',
        ContactAccessLevel = 'Edit'
));

insert shares;

The Edit share record looks to insert correctly;

System.debug(JSON.serialize(
  [ SELECT Id,
   ContactId,
   ContactAccessLevel
   FROM ContactShare
   WHERE UserOrGroupId = :users[1].Id and ContactId = :contacts[1].Id]);

{
   "attributes":{
      "type":"ContactShare",
      "url":"/services/data/v52.0/sobjects/ContactShare/03s2a00002EgjV6AAJ"
   },
   "Id":"03s2a00002EgjV6AAJ",
   "ContactId":"0032a00000milAAAAY",
   "ContactAccessLevel":"Edit"
}

So I'm expecting user[1] to have Edit access to contacts[1], but when I query user[1]'s access:

System.debug(JSON.serialize(
  [ SELECT RecordId,
   HasEditAccess
   FROM UserRecordAccess
   WHERE UserId = :users[1].Id AND RecordId = :contacts[1].Id ]));

{
   "attributes":{
      "type":"UserRecordAccess",
      "url":"/services/data/v52.0/sobjects/UserRecordAccess/0032a00000milAAAAY"
   },
   "RecordId":"0032a00000milAAAAY",
   "HasEditAccess":false,
   "Id":"0032a00000milAAAAY"
}

HasEditAccess comes up false. I'm missing something, any insights appreciated.

Answer 1

Turns out it was just the profile CRUD settings, a share can't allow more access to those operations than the profile will allow